registry  /  @rivet-health/design-system  /  40.2.0

@rivet-health/design-system@40.2.0

⚠ Under review

Documentation available at [rivethealth.github.io/design-system](https://rivethealth.github.io/design-system).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
SourceNo risky source behavior triggered.
Supply chain
HighEntropyStringsMinifiedUrlStrings
Manifest
NoLicense
scanned 124 file(s), 5.42 MB of source, external domains: www.w3.org

Source & flagged code

3 flagged · loading source
fesm2015/rivet-health-design-system.mjsView file
4087contains invisible/control Unicode U+200B (zero width space) const ZWS_REGEX = /<U+200B>/g;
Critical
Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

fesm2015/rivet-health-design-system.mjsView on unpkg · L4087
•Trigger-reachable chain: manifest.module -> fesm2015/rivet-health-design-system.mjs Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

fesm2015/rivet-health-design-system.mjsView on unpkg
styles/tokens/InterVariable.woff2View file
•path = styles/tokens/InterVariable.woff2 kind = high_entropy_blob sizeBytes = 352240 magicHex = [redacted]
High
Ships High Entropy Blob

Package ships high-entropy non-source blobs.

styles/tokens/InterVariable.woff2View on unpkg

Findings

2 Critical1 High1 Medium3 Low
CriticalTrojan Source Unicodefesm2015/rivet-health-design-system.mjs
CriticalTrigger Reachable Dangerous Capabilityfesm2015/rivet-health-design-system.mjs
HighShips High Entropy Blobstyles/tokens/InterVariable.woff2
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowUrl Strings
LowNo License